The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly directs the agent to execute a shell command (ls -1 "$POWERSUIT_OVERLAY/vestige") to locate an external directory. It further instructs the agent to read and follow instructions from that directory, enabling arbitrary file system traversal based on the $POWERSUIT_OVERLAY environment variable.
[PROMPT_INJECTION]: The 'Overlay' mechanism creates a high-risk instruction override vulnerability. By stating 'Where the overlay and this file disagree, follow the overlay,' the skill allows external, unverified content to subvert the agent's defined behavior and safety constraints.
[DATA_EXFILTRATION]: The skill targets sensitive file paths in the user's home directory, specifically ~/.claude/guess-gate.json (for configuration) and ~/.claude/guess-scan.log (for logging). Accessing these paths can lead to the exposure of user activity, environment details, or internal configuration.
[INDIRECT_PROMPT_INJECTION]: The skill processes 'hallucinated' references such as paths, commands, and quotes from potentially untrusted inputs and verifies them using shell-based tools.
Ingestion points: Replied text containing paths, commands, usernames, or quotes intended for verification (SKILL.md).
Boundary markers: None identified; there are no instructions to sanitize or escape the content before verification.
Capability inventory: The skill utilizes which, grep, and filesystem existence checks (exists) via the referenced hooks/guess-scan.js script (SKILL.md).
Sanitization: There is no evidence of sanitization or input validation, creating a surface where a malicious payload in a 'hallucinated' string could result in command injection when passed to which or grep.

guess-gate